Patch Ticker

Red Hat build of Keycloak SAML broker accepts assertions without key proof, allowing impersonation

A company login server that uses outside accounts can let others sneak into victims' accounts.

Summary

The SAML identity broker in Keycloak, which hands logins off to external identity providers, does not check that a user holds the private key for a holder-of-key assertion. An attacker who intercepts a signed assertion can replay it to impersonate the victim; Red Hat build of Keycloak 26.4 and 26.6 and Red Hat Single Sign-On 7 are affected.

Affected when

  • SAML identity broker delegating logins to external identity providers

What to do

Update 26.4 installs to 26.4.17 and 26.6 installs to 26.6.8 or later. Red Hat Single Sign-On 7 has no fixed version in the sources, so check Red Hat's advisory.

Update to at least the version for your product:

  • Red Hat build of Keycloak 26.4 26.4.17 or later
  • Red Hat build of Keycloak 26.6 26.6.8 or later

Products and platforms

  • Linux
  • Red Hat build of Keycloak 26.4
  • Red Hat build of Keycloak 26.4.17
  • Red Hat build of Keycloak 26.6
  • Red Hat build of Keycloak 26.6.8
  • Red Hat Single Sign-On 7

CVE IDs

Sources

Times

First published

First seen